Update to Pyodide v314.0.0

[agriyakhetarpal]

📝 Summary

This PR updates Pyodide to v314.0.0, which we released yesterday: https://blog.pyodide.org/posts/314-release/

This is my first contribution to marimo, and I ought to have asked about it first, based on the contributing guide, but I remember that I was already involved in a conversation about Pyodide-related updates and that there were discussions about missing packages. I cannot seem to find that issue in the list of open issues now :/, so I hope y'all don't mind me chiming in directly with a PR! Thank you!

Also, it looks like y'all have your own Pyodide lockfile at https://wasm.marimo.app/pyodide-lock.json. Since many of the disabled packages in later Pyodide versions are available, I think this infrastructure needs to be updated at marimo's end and can now rely on https://cdn.jsdelivr.net/pyodide/v314.0.0/full/pyodide-lock.json. Please let me know in case any packages are not available.

I have read the CLA Document and I hereby sign the CLA

📋 Pre-Review Checklist

• For large changes, or changes that affect the public API: this change was discussed or approved through an issue, on Discord, or the community discussions (Please provide a link if applicable).
• Any AI generated code has been reviewed line-by-line by the human PR author, who stands by it.
• Video or media evidence is provided for any visual changes (optional).

✅ Merge Checklist

• I have read the contributor guidelines.
• Documentation has been updated where applicable, including docstrings for API changes.
• Tests have been added for the changes made.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
marimo-docs	Ready	Preview, Comment	Jun 10, 2026 10:09am

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[agriyakhetarpal]

Looks like the CLA check did not recognise the text in the PR description. Leaving it in a new comment below:

[agriyakhetarpal]

I have read the CLA Document and I hereby sign the CLA

[agriyakhetarpal]

recheck

[agriyakhetarpal]

I haven't run the full test suite locally yet, but I ran the Pyodide acceptance check and various tests for the WASM rules, and they passed. Note that I had to manually add Pyodide 314.0.0 to the cooldown ignore list in the pnpm configuration, as there is no way to install it otherwise 😅 Could the CI be triggered on this PR? Thank you!

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the project’s Pyodide/wasm compatibility configuration and linting to reflect new “wasm-incompatible” imports, and adds a regression test for the new rule behavior.

Changes:

• Bump the Pyodide version references and update derived Python version metadata.
• Extend the wasm incompatible-imports lint rule to flag pydecimal (and test) and add a related lint test fixture.
• Extend the runtime install() API with new keyword-only parameters (constraints, reinstall).

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tests/_lint/test_wasm_rules.py	Adds a test asserting pydecimal is flagged by the wasm incompatible-imports rule.
tests/_lint/test_files/wasm_incompatible.py	Extends the wasm-incompatible fixture to import pydecimal.
pnpm-workspace.yaml	Adds a workspace release-age exclude entry for the updated Pyodide version.
marimo/_runtime/patches.py	Extends install() signature with new keyword-only params.
marimo/_pyodide/pyodide_constraints.py	Updates Pyodide version and derived Python version metadata.
marimo/_lint/rules/wasm/incompatible_imports.py	Flags additional imports (pydecimal, test) as wasm-incompatible.
frontend/package.json	Bumps the pyodide dependency version.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

[agriyakhetarpal]

Since Pyodide 0.28, we convert JS null to pyodide.ffi.JsNull instead of None. So if I understand correctly, js.user_config.to_py() and js.query_params.to_py() below can carry null (like a nullable display.locale), and JsNull is neither None nor msgspec-encodable.

Note: I am aware that we have this option as deprecated upstream though, so I think we need make null --> None happen before passing it along and I'm not sure about this a bit, need to read some more marimo code 😄

[mscolnick]

this sounds ok, thanks for flagging

[agriyakhetarpal]

So I dug into a few things and I started comparing https://wasm.marimo.app/pyodide-lock.json against our 314.0.0 lockfile on jsDelivr at https://cdn.jsdelivr.net/pyodide/v314.0.0/full/pyodide-lock.json. I think the results are worth sharing:

https://wasm.marimo.app/pyodide-lock.json has 357 packages. Most of them (334) are just relative filenames and basically a snapshot of Pyodide's standard package set at the time. The other 23 are absolute URLs, which is where I see they are patched-in things Pyodide either didn't have at the time or had at the wrong version.

I went through all 23 of those custom entries and checked them against the bundled set we have in 314.0.0:

• 8 of them can probably just be dropped, because 314.0.0 now bundles the same or a newer version anyway: anyio, distro, jiter, openai, platformdirs, polars, pyarrow, and sniffio. We have enabled Polars and PyArrow since the 0.29.x series.
• narwhals is worth a second look as it's pinned to 2.19.0, and our 314.0.0 lockfile ships 2.18.1, so we are slightly behind. I am unsure about its inclusion in the lockfiles, since it's pure Python and probably doesn't need to be in them? (cc: @MarcoGorelli)
• The remaining 14 still aren't in our set at all, so you'd want to keep these (re-pinned to current versions): anywidget, black, comm, ipywidgets, jupyterlab-widgets, markdown, mypy-extensions, pathspec, psygnal, pymdown-extensions, sqlglot, widgetsnbextension, and marimo and marimo-base.

As for whether marimo needs a custom lockfile at all going forward, TBH I think yes, but only because of marimo/marimo-base. The frontend resolves that wheel through whatever lockfile is active via the packages option in loadPyodide, and obviously our own lockfile has no idea what marimo is. So, IIUC, that one entry, which changes with every release, is really the load-bearing reason this hosted lockfile exists?

That said, a bigger idea—to offer some food for thought—is that if instead of relying on the lockfile to resolve marimo-base and those other 14 packages, the frontend just did micropip.install(<url>) for each of them directly during bootstrap, you could probably drop the custom lockfile entirely and point lockFileURL straight at https://cdn.jsdelivr.net/pyodide/v314.0.0/full/pyodide-lock.json (or just not set it, since that's the default relative to indexURL anyway). That would also make the packageBaseUrl workaround I added unnecessary, since it'd naturally resolve against jsDelivr. It's a bigger change than just bumping the version though, so probably worth its own discussion rather than bundling it into this upgrade.

[mscolnick]

@agriyakhetarpal, our lockfile just extends the pyodide one at runtime (on the fly). we only declare about 4 custom packages (~a total of 34 including transitive) that get put in the lockfile.

visiting https://wasm.marimo.app/pyodide-lock.json right now will just give you v0.27.0
visiting https://wasm.marimo.app/pyodide-lock.json?pyodide=v314.0.0 will give you the latest pyodide lockfile with our overlays.

we need this regardless because this helps with waterfalls and slow load times, otherwise we need to reach out to pypi for dependency resolution.

[codecov]

Bundle Report

Changes will increase total bundle size by 11.28kB (0.04%) ⬆️. This is within the configured threshold ✅

Detailed changes

Bundle name	Size	Change
marimo-esm	25.31MB	11.28kB (0.04%) ⬆️

Affected Assets, Files, and Routes:

view changes for bundle: marimo-esm

Assets Changed:

Asset Name	Size Change	Total Size	Change (%)
assets/index-*.css	445 bytes	368.03kB	0.12%
assets/edit-*.js	-32 bytes	326.12kB	-0.01%
assets/layout-*.js	2.95kB	202.44kB	1.48%
assets/add-*.js	-32 bytes	202.22kB	-0.02%
assets/file-*.js	194 bytes	47.15kB	0.41%
assets/worker-*.js	3.89kB	89.11kB	4.56%
assets/save-*.js	3.89kB	85.13kB	4.78%
assets/useCellActionButton-*.js	-32 bytes	9.45kB	-0.34%
assets/scratchpad-*.js	9 bytes	8.41kB	0.11%
assets/RunButton-*.js	9 bytes	6.82kB	0.13%
assets/mermaid-*.core-Cw_lBEej.js (New)	2.38kB	2.38kB	100.0% 🚀
assets/useDeleteCell-*.js	183 bytes	2.22kB	8.98% ⚠️
assets/mermaid-*.core-Dd2Ndc5i.js (Deleted)	-2.38kB	0 bytes	-100.0% 🗑️
assets/play-*.js (Deleted)	-190 bytes	0 bytes	-100.0% 🗑️

[mscolnick]

I've removed some unnecessary packages and cleaned up our lockfile for 3.14 a bit more: https://wasm.marimo.app/pyodide-lock.json?pyodide=v314.0.0

[mscolnick]

thank you for making this change! this is a big release, congrats!

[agriyakhetarpal]

Amazing, thanks for the review @mscolnick and for the lockfile updates!